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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address ~ 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

Responsive to communication(s) filed on 12 November 2000 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-29 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) D Claim(s) is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) ^ The drawing(s) filed on 12 November 2000 is/are: a)K accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) ^ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) Q Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 Certified copies of the priority documents have been received. 

2.Q Certified copies of the priority documents have been received in Application No. . 



3.D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



This action is responsive to the application filed on November 12, 2000. Claims 1-29 are 
pending. Claims 1-29 represent a method for dynamic modification of Internet firewalls. 

Oath/Declaration 

The oath or declaration is defective. A new oath or declaration in compliance with 37 

CFR 1.67(a) identifying this application by application number and filing date is required. See 

MPEP §§ 602.01 and 602.02. 

The oath or declaration is defective because: 

It was not executed in accordance with either 37 CFR 1.66 or 1.68. 



The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 35 1(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

Claims 1-5, 15-18 and 28 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Humes US Patent No. 6,539,430. Humes discloses the invention substantially as claimed 
including a method for filtering data. See abstract. 

As per claims 1,15 and 28 Humes discloses a method, apparatus and computer program 



Claim Rejections - 35 USC §102 



product for filtering content, comprising: 
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assigning point values to a plurality of keywords (assigning a value to certain words; 
column 2, lines 36-44; column 3, lines 6-19; column 4, lines 9-14); 

receiving a first plurality of documents from a source (retrieving documents; column 3, 
lines 34-42); 

comparing text of each of the first plurality of documents with the plurality of keywords 
(comparing the document with the words of the dictionary; column 3, lines 60-67); 

calculating a score for each of the first plurality of documents based on the point values 
and the results of the comparison (assigning a score; column 5, lines 56-67; column 6, lines 1-15; 
column 6, lines 51-64); 

calculating an first average of the scores for the first plurality of documents (calculating 
an average; column 8, lines 4-19); and 

blocking access to the source if the first average score exceeds a threshold (blocking the 
document; column 3, lines 6-19; column 5, lines 14-30; column 6, lines 51-64; column 7, lines 
66-67; column 8, lines 1-5). 

As per claims 2 and 16 Humes discloses the method and apparatus of claims 1 and 15 
wherein the keywords and corresponding point values are stored in a keyword search table 
(keywords stored in a dictionary; column 4, lines 1-25; column 6, lines 40-50; column 8, lines 
43-52; column 9, lines 5-35). 

As per claims 3 and 17, Humes discloses the method and apparatus of claims 1 and 15 
wherein the step of blocking access to the source comprises entering a known-block rule in a 
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rules table, the known-block rule indicating that the source is to be blocked (blocking the entire 
site; column 3, lines 20-33; column 6, lines 40-50). 

As per claim 4 and 18, Humes discloses the method and apparatus of claims 1 and 15 
further comprising: 

entering a known-safe rule in a rules table if the first average score does not exceed the 
threshold, the known-safe rule indicating that access to the source is to be permitted (allowing 
access to the entire document; column 3, lines 20-33 ;column 6, lines 30-39) 

As per claim 5, Humes discloses the method of claim 1, further comprising: 

if the first average score does not exceed the threshold, performing tile following steps: 

receiving a second plurality of documents from a source; 

comparing text of each of the second plurality of documents with the plurality of 
keywords; 

calculating a score for each of the second plurality of documents based on the point 
values and the results of the comparison; 

calculating a second average of the scores for the second plurality of documents; 
and blocking access to the source if the average score exceeds a threshold (blocking the 
document; column 3, lines 6-19; column 5, lines 14-30; column 6, lines 51-64; column 7, lines 
66-67; column 8, lines 1-5). 
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Claim Rejections - 35 USC § 103 



The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 6-14, 19-27 and 29 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Humes US Patent No. 6,539,430 in view of Thomas US Patent No. 6,401,1 1-8. Thomas 
discloses the invention as claimed including an online monitoring system. 

As per claims 6 and 19, Humes discloses the method and apparatus of claims 1 and 15. 
Humes does not disclose wherein the method is performed in a firewall. Thomas discloses "the 
method is performed in a firewall" (See column 4, lines 38-67; column 5, lines 1-6). It would 
have been obvious to a person of ordinary skill in the art at the time of the invention to combine 
the method of a firewall of Thomas with the method of Humes. A person of ordinary skill in the 
art would have been motivated to do this to protect a cluster of more loosely administered 
machines from external invasion. 

As per claims 7, 20 and 29 Humes discloses a method, apparatus and computer program 
product for filtering content, comprising: 

assigning point values to a plurality of keywords (assigning a value to certain words; 
column 2, lines 36-44; column 3, lines 6-19; column 4, lines 9-14); 
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receiving a request for a document from a client (retrieving documents; column 3, lines 



receiving the document from a source (retrieving documents; column 3, lines 34-42); 

comparing text of each of the plurality of documents with the plurality of keywords 
(comparing the document with the words of the dictionary; column 3, lines 60-67); 

calculating a score for the document based on the point values and the results of the 
comparison (assigning a score; column 5, lines 56-67; column 6, lines 1-15; column 6, lines 51- 



calculating an average score over the decision interval if the decision interval has been 
reached for the source (calculating an average; column 8, lines 4-19); and 

blocking access to the source if the average score exceeds a threshold. 

Humes does not disclose determining if a decision interval has been reached. Thomas 
discloses determining if a decision interval has been reached. See column 7, lines 55-67; column 
8, lines 1-34. It would have been obvious to a person of ordinary skill in the art at the time of the 
invention to combine a decision interval of Thomas with the monitoring system of Humes. A 
person of ordinary skill in the art would have been motivated to do this to not burden the host 
resources. 

As per claims 8 and 21, Humes and Thomas disclose the method and apparatus of claims 
7 and 20 wherein the keywords and corresponding point values are stored in a keyword search 
table (Humes; keywords stored in a dictionary; column 4, lines 1-25; column 6, lines 40-50; 
column 8, lines 43-52; column 9, lines 5-35). 



34-42); 



64); 
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As per claims 9 and 22, Humes and Thomas disclose the method and apparatus of claims 
7 and 20. Humes does not disclose wherein the decision interval is a length of time. Thomas 
discloses wherein the decision interval is a length of time. See column 9, lines 1-6. It would 
have been obvious to a person of ordinary skill in the art at the time of the invention to combine 
a decision interval of time of Thomas with the monitoring system of Humes. A person of 
ordinary skill in the art would have been motivated to do this to not burden the host resources. 

As per claims 10 and 23, Humes and Thomas disclose the method and apparatus 
of claims 7 and 20. Humes does not disclose wherein the decision interval is a number of 
documents. Thomas discloses wherein the decision interval is a number of documents. See 
column 7, lines 55-67; column 8, lines 18-34. It would have been obvious to a person of 
ordinary skill in the art at the time of the invention to combine a decision interval of a number of 
documents of Thomas with the monitoring system of Humes. A person of ordinary skill in the 
art would have been motivated to do this to not burden the host resources. 

As per claims 1 1 and 24, Humes and Thomas disclose the method and apparatus of 
claims 7 and 20, wherein the step of blocking access to the source comprises entering a known- 
block rule in a rules table, the known block rule indicating that the source is to be blocked 
(Humes; blocking the entire site; column 3, lines 20-33; column 6, lines 40-50). 

As per claims 12 and 25, Humes and Thomas disclose the method and apparatus of 
claims 7 and 20 further comprising: 
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entering a known-safe rule in a rules table if the first average score does not exceed the 
threshold, the known-safe rule indicating that access to the source is to be permitted (Humes; 
allowing access to the entire document; column 3, lines 20-33 ;column 6, lines 30-39). 

As per claims 13 and 26, Humes and Thomas disclose the method and apparatus of 
claims 7 and 20. Humes does not disclose further comprising: passing the document to the client 
if the decision interval has not been reached. Thomas discloses wherein the document is passed 
to the client if the decision interval has not been reached. See column 8, lines 66-67; column 9, 
lines 1-6. It would have been obvious to a person of ordinary skill in the art at the time of the 
invention to combine a decision interval of Thomas with the monitoring system of Humes. A 
person of ordinary skill in the art would have been motivated to do this to not burden the host 
resources. 

As per claims 14 and 27, Humes and Thomas disclose the method and apparatus of 
claims 7 and 20, further comprising: 

passing the document to the client if the first average score does not exceed the threshold 
(Humes; allowing access to the entire document; column 3, lines 20-33 ;column 6, lines 30-39). 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Russell-Falla et al. US Patent No. 6,675,162 
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Toga US Patent No. 6,041, 355 
Shanon US Patent No. 6,233,618 
Donohue et al US Patent No. 5,9687,480 
Mitchell US Patent No. 6,701,350 
MacLean US Patent No. 6,701,350 
Brown et al. US Patent No. 5,941,947 
Dutta US Patent No. 6,684,254 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Uzma Alam whose telephone number is (703) 305-8420. The 
examiner can normally be reached on Monday-Tuesday 1 1 :30am-8pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ario Etienne can be reached on (703) 308 - 7562. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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